Privacy Policy

This Privacy Policy describes how Alex Fischer (“we,” “us,” or “our”) collects, uses, and protects your personal information when you use this website (https://artofalexfischer.com) and related services (the “Services”).

Questions? Contact us at afischerharold@gmail.com.

1. What Information Do We Collect?

We collect the following personal information:

Inquiry and Contact Forms: When you submit an inquiry (for artwork, commissions, prints, or licensing) or a message through the contact form, we collect your name, email address, the nature of your inquiry, and any message or artwork details you provide. They are kept in the studio’s records as a contact and an inquiry. The contact form also records the IP address your message came from, kept with the message.

Mailing List Subscription: If you subscribe to our mailing list, we collect your email address and the date. We email you a link to confirm; you are on the list only once you open it.

Accounts: If you create an account, we keep your email address, the works and views you save to your collection, and, if you choose to set one, your password as a one-way hash (never the password itself). Sign-in links are valid for 30 minutes and are stored only as a one-way hash. If a private viewing room has been prepared for you, we keep your email address with it.

Purchases: Payments are handled by Stripe. Your card details go to Stripe and never reach us. We keep a record of each order: what was bought, the amount, the date, Stripe’s reference for the payment, and a one-way hash of your IP address for that day.

Prints made from the viewer: If you frame a view of a work to order as a print, the picture you framed is uploaded to us, with the same daily one-way hash of your IP address. If you save or share a view, we keep its code, the work it is of, and its title.

Games: If you play a game on the Site and save a score or a game, we keep the name you choose, your scores and saved games, and a secret that identifies your device, stored as a one-way hash. If you are signed in, they are linked to your account.

Device Check: If you run the device check at /check, we keep a description of your browser and device as your browser reports it, how the device handled the test, any note you add, and, if your device allows it, a small picture of what your screen drew. We do not keep your IP address with it.

Analytics: We use Google Analytics 4 (GA4) to collect data about how visitors use this Site, such as pages visited, session duration, and general geographic region. It loads on every public page without asking first; there is no cookie banner. IP anonymization is enabled — your full IP address is not stored by Google Analytics. GA4 uses cookies to function.

Server Logs: Our web server automatically records standard access logs, including IP address, browser type, referring page, and date/time of access. These logs are used for security monitoring and troubleshooting.

Rate Limiting and Error Reports: To prevent automated abuse of our forms and pages, we count requests per IP address. We keep a one-way hash of the address, made with a secret key so it cannot be turned back into the address, not the address itself. When a page fails a security check in your browser, the browser sends us a report; we keep it with your browser’s description and a shortened form of that hash.

Email: Until an email service is connected, the emails the Site would send you (sign-in links, viewing-room keys, subscription confirmations) are written to a log on our server instead of being sent.

We do not collect: payment card information, government-issued identification, precise geolocation, or sensitive personal data.

All personal information you provide must be accurate and up to date.

2. How Do We Use Your Information?

We use collected information to:

• Respond to artwork inquiries, commission requests, and licensing discussions
• Process orders and print order inquiries and communicate order details
• Sign you in, and keep your saved collection, if you have an account
• Send mailing list updates to subscribers (only if you have subscribed and confirmed)
• Improve and maintain the Site
• Monitor for and prevent security threats and abuse

3. Legal Bases for Processing

If you are located in Canada, we process your information under the Personal Information Protection and Electronic Documents Act (PIPEDA), generally with your consent (express or implied) or as necessary to fulfill a request you have made.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases under GDPR/UK GDPR:

• Consent: for the mailing list
• Performance of a contract: for orders and accounts
• Legitimate interests: for analytics, security monitoring and rate limiting
• Legal obligations: where required by law

You may withdraw your consent at any time by contacting afischerharold@gmail.com.

4. Cookies and Tracking Technologies

We use Google Analytics 4, which places cookies on your device to track usage patterns; it is not loaded for the site’s own administrator. The Site also sets one session cookie, which the forms, the cart and sign-in need to work. Your browser keeps your cart, your saved views and your recent orders in its own storage on your device. You can disable cookies via your browser settings. Doing so may affect some Site functionality. We do not use any other tracking technologies or advertising cookies.

5. How Long Do We Keep Your Information?

• Inquiry and contact form data, including the IP address kept with a contact form message, is retained as long as necessary to respond to and record business correspondence. It is not deleted automatically.
• Mailing list email addresses are retained until you unsubscribe.
• Account details and your saved collection are retained until you delete your account. Used and expired sign-in links are removed a day after they expire.
• Order records are kept as business records.
• Pictures uploaded for prints expire after 30 days and are deleted the next time the Site clears out expired ones, unless they belong to an order that has not been fulfilled yet.
• Saved views, game names, scores and saves, and device-check reports are not deleted automatically. Ask us and we will delete yours.
• Rate-limiting records stop being used after a day and are deleted automatically after about two days.
• Security error reports are kept until the log reaches a fixed size, then replaced.
• The email log described above is cleared of messages older than seven days.
• Analytics data is retained according to Google’s data retention settings (configurable, default 26 months).
• Server logs are retained for a reasonable security monitoring period.

When information is no longer needed, it is deleted or anonymized.

6. Do We Share Your Information?

We do not sell your personal information. We may share limited information in the following circumstances:

Google Analytics: Usage data is shared with Google as part of the GA4 service. See Google’s Privacy Policy.

Stripe: When you buy something, your payment details are given to Stripe, which processes the payment. We send Stripe the amount and a description of what is being bought. See Stripe’s Privacy Policy.

Print Fulfillment Partners: If a print order involves a third-party print provider, we may share the minimum necessary order information (such as artwork file and delivery details) with that provider.

Legal Requirements: We may disclose information if required by law, court order, or governmental authority.

7. Do We Collect Information from Minors?

We do not knowingly collect personal information from persons under 18 years of age. By using the Services, you represent that you are at least 18 years old.

8. What Are Your Privacy Rights?

Depending on your jurisdiction, you may have rights to:

• Access and obtain a copy of your personal information
• Correct inaccurate information
• Request deletion of your personal information
• Restrict or object to processing
• Data portability (where applicable under GDPR)

To exercise any of these rights, email afischerharold@gmail.com. We will respond in accordance with applicable law.

If you are in the EEA or UK and believe we are processing your information unlawfully, you have the right to lodge a complaint with your local data protection authority.

9. Do-Not-Track

We do not currently respond to Do-Not-Track (DNT) browser signals, as no uniform standard exists for implementing them.

10. Updates to This Policy

We may update this Privacy Policy from time to time. The updated version will be effective upon posting, indicated by the “Last Updated” date above. We encourage you to review this policy periodically.

11. Contact Us

Alex Fischer
38 Abell Street, Suite 313
Toronto, Ontario M6J 0A2
Canada
afischerharold@gmail.com